feat(ebs-sync): EBS config health check on status + version endpoints

[maxakuru]

What

Adds a non-secret EBS config health check to two endpoints so we can confirm a deployment is pointed at the correct (prod vs stage) EBS integration.

• forms/version (public, unauthenticated) — booleans only, for both the SOAP EBS_* and JSON EBS_JSON_* targets:

  {
    "version": "1.4.0",
    "config": {
      "ebs":     { "configured": true, "targetsStage": false, "apiKeyMatchesStage": false },
      "ebsJson": { "configured": true, "targetsStage": false, "apiKeyMatchesStage": false }
    }
  }

• ebs-sync/ebs-sync GET (authed via SYNC_STATUS_TOKEN) — adds an ebs block alongside the existing sync state, including host + configured for the SOAP endpoint.

targetsStage: true on a prod deployment means it is pointed at the staging EBS. No hosts (except the authed endpoint), URLs, or API keys are ever returned.

Why

Prod ebs-sync was recently observed syncing live orders to the staging EBS integration. Order sync always uses the deployment-default EBS_BASE_URL / EBS_API_KEY (see ebs-sync/ebs.js) — there is no code-level misroute — so the target is whatever config was baked into the deployed action. Because both the default and the _STAGE pair are injected into every deployment, default === stage is a precise, format-independent signal that a deployment is talking to staging. These endpoints surface that directly instead of guessing prod-ness from the URL string.

How to use

# public probe
curl https://<prod-namespace>.adobeioruntime.net/api/v1/web/forms/version

# detailed authed probe
curl -H "Authorization: Bearer $SYNC_STATUS_TOKEN" \
  https://<prod-namespace>.adobeioruntime.net/api/v1/web/ebs-sync/ebs-sync

Notes

• No app.config.yaml change needed — the forms package already injects all EBS_* / EBS_JSON_* vars, and ebs-sync already receives the SOAP EBS_* pair.
• These fields reflect the config baked into the currently-deployed action, so they only become queryable after a successful prod deploy.